Loading story…
Apache Tomcat's XML parser handling flaws, CVE-2014-0119 and CVE-2013-4590, could allow a malicious application deployed on a shared Tomcat instance to access sensitive information. CVE-2014-0119 allowed an application to replace XML parsers used by the default servlet, potentially bypassing external-entity limits or reading XML files belonging to other applications; CVE-2013-4590 enabled application-supplied XML files to resolve external entities and potentially bypass Java SecurityManager restrictions.
Red Hat released updated tomcat6 packages for RHEL 6, including tomcat6-6.0.24-78.el6_5, and advised administrators to restart Tomcat after applying the update. Affected organizations should use vendor-provided backports or upgrade to fixed upstream releases: Tomcat 6.0.41, 7.0.53, 8.0.5, or later; Tomcat 6 is now end of life and no longer receives security fixes.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2014:1038 for RHEL 6, supplying backported tomcat6 fixes including tomcat6-6.0.24-78.el6_5. The update addressed XML external-entity and XML-parser replacement issues, and Red Hat advised users to update and restart Tomcat.
Red Hat issued RHSA-2014:1034 for RHEL 7, providing tomcat-7.0.42-8.el7_0 and related packages with a backported fix for CVE-2014-0119. The advisory advised administrators to update and restart Tomcat to prevent malicious web applications from replacing XML parsers and accessing XML processed by other applications.
CVE-2014-0119, an information-disclosure flaw caused by replacement of XML parsers used in Tomcat XSLT processing, was reported. A remote unauthenticated attacker could use a specially crafted application to obtain sensitive information.
CVE-2013-4590 was published for an XML external entity vulnerability in Apache Tomcat that could disclose internal Tomcat information through an untrusted web application containing a crafted XML document. Affected releases included Tomcat versions before 6.0.39, 7.0.50, and 8.0.0-RC10.
Ubuntu published security notice USN-2654-1 addressing Tomcat vulnerabilities. The provided reference does not specify the affected versions, CVEs, or release date.
Red Hat released a Moderate-impact security update for JBoss EAP 6.2.4 addressing CVE-2014-0075, CVE-2014-0099, CVE-2014-0096, and CVE-2014-0119. The update mitigated denial-of-service, HTTP request-smuggling, XXE, and XML-parser replacement issues; Red Hat advised customers to apply it and restart JBoss.
Red Hat released JBoss Data Grid 6.3.0 to replace version 6.2.1, fixing moderate-impact flaws including JBoss Web denial-of-service, request-smuggling, XXE, and XML-parser hijacking issues. The release also fixed plaintext and world-readable audit-log issues (CVE-2014-0058 and CVE-2014-0059) and added configurable audit logging and masking controls.
JBoss Web incorporated a fix for CVE-2014-0119 in version 7.4.7.Final, preventing malicious web applications from replacing XML parsers and accessing XML processed by other applications on the same instance.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
18 references tracked. Mallory keeps watching after this page renders.
exchange.xforce.ibmcloud.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcelinux.oracle.com
Open sourcebugzilla.redhat.com
Open sourceseclists.org
Open sourcemandriva.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released updates for Apache Tomcat and JBoss Web Server deployments on RHEL 6 and RHEL 7 to remediate vulnerabilities spanning local privilege escalation, SecurityManager bypass, directory traversal and disclosure, sensitive-data exposure, and denial of service. On RHEL 6, writable Tomcat configuration files could allow the `tomcat` user—or a compromised web application—to gain root-level code execution through service lifecycle actions; older Tomcat code also allowed authenticated malicious applications to bypass SecurityManager isolation and list parent deployment directories. The updates also address a Commons FileUpload flaw, `CVE-2016-3092`, in which crafted multipart boundaries near the 4,096-byte buffer length could severely slow processing or crash affected Tomcat 7 and 8 applications. Later packages fixed username enumeration through Realm timing differences, SecurityManager bypasses, protected system-property exposure, and unauthorized access to global JNDI resources via `ResourceLinkFactory`; affected organizations should deploy the supported Red Hat Tomcat or JBoss Web Server package updates for their platform.
Aug 29, 2026
Red Hat released Moderate-impact updates for Apache Tomcat, JBoss Web Server, JBoss EAP 6.2.4, and JBoss Data Grid to remediate **CVE-2014-0075**, **CVE-2014-0099**, and **CVE-2014-0096**. The flaws could permit remote denial of service through unbounded chunked-transfer input, HTTP request smuggling via integer overflow while parsing `Content-Length` headers—particularly where a vulnerable server sits behind a reverse proxy—and XML external entity (XXE) processing in Tomcat DefaultServlet handling of user-supplied XSLTs. JBoss EAP and Data Grid updates additionally addressed XML parser abuse that could bypass XXE restrictions and expose XML files belonging to other applications on the same instance. Affected RHEL 6 and 7 Tomcat deployments, JBoss Web Server 2.0.1 installations, and EAP 6.2.4 environments should install the applicable vendor packages or upgrades and restart Tomcat or the JBoss server process. Red Hat supplied patched builds including `tomcat-7.0.42-6.el7_0` for RHEL 7 and `tomcat6-6.0.24-72.el6_5` for RHEL 6; JBoss Data Grid 6.2.1 users were directed to upgrade to 6.3.0. Administrators should back up JBoss installations, applications, and configurations before applying updates, and prioritize externally reachable services deployed behind reverse proxies.
Aug 29, 2026
Apache released Tomcat **11.0.25**, **10.1.58**, and **9.0.121** to remediate 11 vulnerabilities across supported release lines. The most consequential issues include `CVE-2026-68569`, where DataSourceRealm principal lookup can fail open with mechanisms such as CLIENT-CERT or SPNEGO; `CVE-2026-65182`, which can bypass security constraints based on path-rule ordering; and `CVE-2026-65927`, an off-by-one RewriteValve error that may bypass access controls. `CVE-2026-68763` also permits denial of service through an HTTP/2 backlog-tracking allocation leak when streams are reset. The updates additionally address authorization bypasses involving FORM-authentication redirects (`CVE-2026-68525`) and `security-role-ref` aliases (`CVE-2026-66422`), a limited DIGEST-authentication replay condition (`CVE-2026-65905`), an HTTP/2 strict-SNI-validation bypass from an incomplete prior fix (`CVE-2026-65637`), a Unix-domain-socket permission race (`CVE-2026-65183`), and WebSocket sessions that can survive expiration of their associated HTTP session (`CVE-2026-73180`). Organizations should prioritize upgrades, particularly for internet-facing deployments; Tomcat 7 and 8.5 installations are end of life and should be retired or otherwise remediated. No confirmed in-the-wild exploitation or public proof-of-concept code was reported.
Aug 31, 2026